DevOps & CI/CD: Complete Implementation Guide for 2026

TL;DR

• DevOps is a culture and set of practices that unify development and operations — CI/CD is its most impactful technical implementation.
• For most teams, GitHub Actions is the best CI/CD starting point in 2026 — cloud-hosted, affordable, and deeply integrated with the GitHub ecosystem.
• Use Docker + Kubernetes for containerisation and orchestration at scale; Terraform for infrastructure as code.
• Blue-green and canary deployments are the safest strategies for releasing changes without downtime.
• Setting up a proper DevOps pipeline costs £8k–£30k in engineering time, plus $200–$1,500/month in ongoing tooling costs.

1. Source control trigger: Developer pushes to a feature branch or opens a pull request. The pipeline starts automatically.
2. Static analysis and linting: Code style, formatting, and basic quality checks run in seconds. Fast feedback, low cost.
3. Unit tests: Automated unit tests run against the change. Failures block the pipeline immediately.
4. Build: The application is compiled or packaged. For containerised apps, a Docker image is built and tagged.
5. Security scanning: SAST (static code analysis for vulnerabilities), SCA (software composition analysis for vulnerable dependencies), and container image scanning run automatically.
6. Integration tests: Tests that verify components work together, often against a test database or mocked external services.
7. Deploy to staging: The build is deployed to a staging environment that mirrors production. End-to-end tests may run here.
8. Performance tests (optional): Load testing to ensure the change doesn't cause performance regressions.
9. Manual approval gate (CD): For Continuous Delivery, a human approves the staging build before production deployment. For Continuous Deployment, this step is skipped.
10. Deploy to production: Using a safe deployment strategy (blue-green, canary, or rolling). Automated rollback triggers if error rate spikes.
11. Post-deployment monitoring: Automated checks verify the deployment is healthy. Alerts fire if key metrics degrade.

Terraform (HashiCorp)

The dominant IaC tool in 2026. HCL (HashiCorp Configuration Language) is declarative and readable. Supports 3,000+ providers including AWS, Azure, GCP, Cloudflare, and Datadog. The Terraform state file tracks what infrastructure exists — store it remotely in S3 or Terraform Cloud. Used by the majority of UK, US, and European cloud engineering teams. Note: HashiCorp moved to the Business Source Licence (BSL) in 2023; OpenTofu is the MIT-licensed community fork.

Pulumi

Write infrastructure in TypeScript, Python, Go, or C# instead of a domain-specific language. Appeals to developer-centric teams who prefer using their existing language tooling (IDEs, type checking, testing frameworks) for infrastructure. Excellent for teams building in Australia and Canada where full-stack engineers often wear infrastructure hats.

AWS CDK (Cloud Development Kit)

If you're AWS-only, CDK lets you define AWS infrastructure in TypeScript, Python, or Java and synthesises CloudFormation templates. Tight AWS service integration and strong type safety. Best for AWS-native teams who want to stay within the AWS ecosystem.

Dockerfile Best Practices

• Use multi-stage builds: A build stage installs all build tools and compiles the application. A final stage copies only the compiled output, resulting in images 5–20x smaller. Smaller images mean faster pulls, less storage cost, and a reduced attack surface.
• Pin base image versions: Use node:20.14-alpine not node:latest — reproducible builds require pinned dependencies.
• Run as non-root: Add USER nonroot:nonroot before the CMD. Running as root inside a container dramatically increases blast radius if the container is compromised.
• Use.dockerignore: Exclude node_modules,.git, test files, and secrets from the build context. Speeds up builds and reduces accidental secret leakage.
• One process per container: Don't run a database and application server in the same container. Keep containers focused and stateless.
• COPY before package install: Copy only package.json/package-lock.json first, run npm install, then copy source. Docker layer caching means dependency installs only re-run when dependencies change.

Key Kubernetes Concepts for DevOps

• Deployments: Declaratively define desired state (e.g., "run 3 replicas of this image"). K8s continuously reconciles actual state with desired state, automatically replacing failed pods.
• Services: Stable DNS names and load balancing for pod groups. Internal services use ClusterIP; external-facing services use LoadBalancer or Ingress.
• Ingress: HTTP/S routing rules mapping external hostnames/paths to internal services. Nginx Ingress and Traefik are the most common Ingress controllers.
• Horizontal Pod Autoscaler (HPA): Automatically scales pod count based on CPU, memory, or custom metrics. Essential for handling traffic spikes in Australian e-commerce or US B2B SaaS platforms.
• ConfigMaps and Secrets: Inject configuration and sensitive values into pods without baking them into images.
• Resource requests and limits: Define CPU and memory requests (guaranteed) and limits (maximum). Prevents one noisy neighbour from starving other services.
• Namespaces: Logical isolation between environments (dev, staging, prod) or teams within the same cluster.
• Readiness and liveness probes: K8s uses readiness probes to know when a pod is ready to receive traffic, and liveness probes to restart stuck pods automatically.

Blue-Green Deployment

Maintain two identical production environments — "blue" (current) and "green" (new version). Deploy to green, run smoke tests, then switch traffic from blue to green instantly via the load balancer or DNS. Zero downtime. If green has issues, switch back to blue in seconds. Requires double the infrastructure during deployment windows. Favoured by UK fintech and US healthcare software teams where downtime has regulatory implications.

Canary Deployment

Route a small percentage of production traffic (e.g., 5%) to the new version. Monitor error rates, latency, and business metrics. If healthy, gradually increase traffic to 25%, 50%, 100%. Roll back instantly if metrics degrade. Canary deployments let you test changes with real production traffic in Canada or Europe before exposing all users — particularly valuable for high-stakes changes like payment flow updates.

Rolling Deployment

Replace old instances with new ones gradually — e.g., update 2 pods at a time out of 10. Simple, zero additional infrastructure cost. Less control than blue-green or canary. Kubernetes Deployments use rolling updates by default. Suitable for teams where downtime risk is lower and infrastructure cost optimisation is a priority.

Secrets Management Options

• GitHub Secrets / GitLab CI Variables: Encrypted secrets injected as environment variables into pipeline jobs. Free and sufficient for most teams. Audit who can view/edit secrets.
• AWS Secrets Manager: Managed secrets service with automatic rotation for RDS credentials, API keys, and OAuth tokens. ~$0.40/secret/month. Integrates natively with ECS, Lambda, and EKS via IAM roles.
• HashiCorp Vault: Self-hosted or cloud-hosted secrets manager with dynamic secret generation, fine-grained access control, and comprehensive audit logs. Used by large enterprises in the UK and Europe meeting ISO 27001 or SOC 2 requirements.
• Doppler / Infisical: Developer-friendly secrets management platforms with good DX. Suitable for startups and mid-market teams in the US, Canada, and Australia who want a simple interface without Vault's operational complexity.

Pipeline Controls for Compliance

• Enforce branch protection rules: no direct pushes to main, required pull request reviews (minimum two approvers for SOC 2)
• Run SAST tools (Semgrep, Snyk SAST, CodeQL) on every build — evidence required for SOC 2 CC7.1
• Run SCA/dependency scanning (Snyk Open Source, Dependabot, OWASP Dependency-Check) — required for supply chain security controls
• Maintain immutable artefact registry — every build artefact is stored with its Git commit SHA, build timestamp, and test results
• Implement change management: all production deployments logged with who approved, what changed, and when
• Configure audit logs for all CI/CD actions — who ran what pipeline, when, and with what result. Store for minimum 12 months.
• Enforce least-privilege service accounts for deployment: the CI runner should only have permission to deploy to production, not to manage IAM or access databases directly

Setup Cost: £8,000–£30,000

Engineering time to design the pipeline, configure CI/CD tooling, write Terraform or CDK for infrastructure, containerise the application, set up Kubernetes, implement observability, and configure secrets management. Varies significantly by starting point — greenfield projects are at the lower end; migrating an existing system is at the higher end.

Ongoing Tooling Cost: $200–$1,500/month

• GitHub Team: ~$4/user/month (10 devs = $40/month)
• GitHub Actions compute: ~$50–200/month depending on build minutes
• AWS EKS cluster: ~$150/month per cluster plus node costs
• Datadog: ~$150–500/month for a team of 10 with APM
• Snyk: free tier or $98/month for teams
• AWS Secrets Manager: ~$20–50/month